Transcript Hacking the Big 4 – Jan 2013 FG

Hacking The Big 4 Databases
Frank Grottola
VP – North American Sales
Effective Database Defense
Agenda
 Data, Databases, Data Theft
 Database Attack Examples
– Oracle: Stealth Password Cracking
– SQL Server: Escalate a Database Owners Privileges to Sys Admin
– Sybase: Escalate Any User’s Privileges to Sys Admin
– DB2: Create Remote OS Admin Users
 Database Security Top 10 Checklist
 How to Protect Your Databases with DbProtect
2
Application Security Inc. All rights reserved. Confidential
Data, Databases, Data Theft
Over 330,000,000
records stolen in
2011
Over 90% of records
stolen from databases
(Verizon DBIR)
(DataLossDB)
Too many organizations have failed to take database security seriously.
3
Application Security Inc. All rights reserved. Confidential
Did You Know?
4
Application Security Inc. All rights reserved. Confidential
So….Is Anyone Actually Surprised?
5
Application Security Inc. All rights reserved. Confidential
Default and Weak Passwords
Default accounts are never good
• Not only DBMS have own default accounts, but applications
install them too
Weak passwords can be cracked
• Just google “<database type> password cracker” – dozens of
them out there
• Names, places, dictionary words make poor passwords
• Rainbow tables make anything under 7 or 8 characters weak
Database login activity seldom monitored
• If you’re not watching, an attacker can guess passwords all day
6
Application Security Inc. All rights reserved. Confidential
Default Account Examples
User: SA / Password: null
User: sys / Password: change_on_install
User: scott / Password: tiger
User: db2admin / Password: db2admin
User: db2as / Password: ibmdb2
User: SA / Password: null
User: root / Password: null
User: admin / Password: admin
User/Password the Same:
DATABASE SECURITY
NOT MY PROBLEM
DBSNMP
7
Application Security Inc. All rights reserved. Confidential
Attacking Oracle
 Attack Target:
– Oracle 11g Release 2
 Privilege Level:
– Any user on the network
 Outcome:
– Obtain any user’s password (login as SYS)
 Vulnerabilities Exploited:
– Oracle Stealth Password Cracking
 Reported by:
– Esteban Martinez Fayo - Team SHATTER - AppSecInc
 Patched by Vendor:
– Oct 2012 CPU
8
Application Security Inc. All rights reserved. Confidential
Attacking Oracle: Failed Login + Packet Capture
9
Application Security Inc. All rights reserved. Confidential
Attacking Oracle: Run Password Brute Force Tool
10
Application Security Inc. All rights reserved. Confidential
Attacking Oracle: Login As SYS
11
Application Security Inc. All rights reserved. Confidential
Attacking Oracle
12
Application Security Inc. All rights reserved. Confidential
Attacking MS SQL Server: SQL Injection
 Attack Target:
– Microsoft SQL Server 2008
 Privilege Level:
– CREATE DATABASE
 Outcome:
– Full control of SQL Server (become SA)
 Vulnerabilities Exploited:
– Privilege escalation via SQL injection in RESTORE function
 Reported By:
– Martin Rakhmanov – Team SHATTER – AppSecInc
 Patched By Vendor:
– Unpatched
13
Application Security Inc. All rights reserved. Confidential
Attacking Sybase
 Attack Target:
– Sybase ASE v15.5
 Privilege Level:
– Login only
 Outcome:
– Full control of Sybase server (become SA)
 Vulnerabilities Exploited:
– Privilege escalation via SQL injection in DBCC IMPORT_METADATA
 Reported by:
– Martin Rakhmanov - Team SHATTER - AppSecInc
 Patched by Vendor:
– Sybase ASE 15.7 ESD #2 (Sept 2012)
14
Application Security Inc. All rights reserved. Confidential
Attacking DB2
 Attack Target:
– IBM DB2 LUW v9.7 (Windows only)
 Privilege Level:
– Login only
 Outcome:
– Full control of database and the server it runs on (become OS admin)
 Vulnerabilities Exploited:
– Arbitrary Code Execution in SQLJ.DB2_INSTALL_JAR
 Reported by:
– Martin Rakhmanov - Team SHATTER - AppSecInc
 Patched by Vendor:
– DB2 9.1 FixPack 12 – August 2012
15
Application Security Inc. All rights reserved. Confidential
Database Security Top 10 Checklist
1: Inventory Databases
2: Tag Critical Systems
3: Change Default Passwords
4: Implement Strong Password Controls
5: Enact and Enforce Patch Management Policies
6: Maintain and Enforce Configuration Standards
7: Document and Enforce Least Privilege Controls
8: Audit Privileged Access
9: Monitor For and Respond To Attacks
10: Encrypt Sensitive Data – At Rest and In Motion
16
Application Security Inc. All rights reserved. Confidential
A Process To Secure Your Databases
Precision Security
DbProtect
17
Application Security Inc. All rights reserved. Confidential
References
Team SHATTER
Security Heuristics of Application Testing Technology for Enterprise
Research
http://www.teamshatter.com
Top 10 Database
Vulnerabilities
http://www.teamshatter.com/topics/general/team-shatterexclusive/top-10-database-vulnerabilities-and-misconfigurations/
Book
Practical Oracle Security
By Josh Shaul
CTO, Application Security, Inc.
Josh Shaul
Chief Technology Officer
Application Security, Inc.
18
Application Security Inc. All rights reserved. Confidential